mumukit-login 5.3.2 → 6.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1e36fd2e076cfae5452b64673fb12a977f0b55e7d39d393268d36a3ab92a44c7
-  data.tar.gz: be2b007c7cad4d8a6ccef8eb04a591d6d2668fa03ad03ee9c9811d738d947991
+  metadata.gz: 8bb86f9086ebb051c3220e522f000cdf86f51ac5afb4385430f0a23a3a631ef4
+  data.tar.gz: f360003953411c4a1fe8174bbcb428427a70bdc49f653a22c039de0633a0ea24
 SHA512:
-  metadata.gz: 4a2b6c4add2e22f9584d16580da9580eb37d7dc6eb48dec741a3bb67ca6d8dfa2208954f4bad68c67dfefec82f87329403dcebe337913664e6aee392d1f9580b
-  data.tar.gz: 153b01a9d3b5411bd57a5bbdab4cde35a84f395c1b72ead874208011da52673f309c6a4edede805bc102c9d76f62d1ca84ca94858f0356b1cd275768ea76e61a
+  metadata.gz: b33e7bf8cc1ed64854aeaed0de4d99a390378c272f0e39a893d95972ece9f9c0fa6d21ba34d7176f0610aa96425c2966f5b43db57d1de0f2c902d2506c6a57c7
+  data.tar.gz: 4d685044b1abcd5ec40c63792a942f3844a28a375ce37116c25cffedad278915971304e4a1d353bfa269b6d0593bb154773aea52ac3348516311c17838f3b994

data/lib/mumukit/login.rb

@@ -4,6 +4,7 @@ require 'addressable/uri'
 require 'omniauth'
 require 'omniauth-auth0'
 require 'omniauth-saml'
+require 'omniauth-google-oauth2'
 
 require 'mumukit/core'
 require 'mumukit/auth'
@@ -29,6 +30,7 @@ module Mumukit::Login
       config.mucookie_duration = ENV['MUMUKI_MUCOOKIE_DURATION'].defaulting(14, &:to_i)
 
       config.provider = Mumukit::Login::Provider.from_env
+
       config.saml = struct base_url: ENV['MUMUKI_SAML_BASE_URL'],
                            idp_sso_target_url: ENV['MUMUKI_SAML_IDP_SSO_TARGET_URL'],
                            idp_slo_target_url: ENV['MUMUKI_SAML_IDP_SLO_TARGET_URL'],
@@ -38,6 +40,8 @@ module Mumukit::Login
       config.auth0 = struct client_id: ENV['MUMUKI_AUTH0_CLIENT_ID'],
                             client_secret: ENV['MUMUKI_AUTH0_CLIENT_SECRET'],
                             domain: ENV['MUMUKI_AUTH0_DOMAIN']
+      config.google = struct client_id: ENV['MUMUKI_GOOGLE_CLIENT_ID'],
+                             client_secret: ENV['MUMUKI_GOOGLE_CLIENT_SECRET']
     end
   end
 
@@ -71,7 +75,7 @@ module Mumukit::Login
   # @param [OmniAuth::Builder] omniauth
   #
   def self.configure_omniauth!(omniauth)
-    provider.configure_omniauth! omniauth
+    Mumukit::Login::Provider.setup_providers! omniauth
   end
 
   def self.configure_login_routes!(native)
@@ -93,7 +97,7 @@ module Mumukit::Login
   end
 
   def self.provider
-    Mumukit::Login.config.provider
+    Mumukit::Platform::Organization.current.login_provider_object || config.provider
   end
 end
 

data/lib/mumukit/login/framework/rails.rb

@@ -64,7 +64,6 @@ module Mumukit::Platform::WebFramework::Rails
   # @param [ActionController::Base::Class] controller_class
   #
   def self.configure_controller!(controller_class)
-    Mumukit::Login.config.provider.configure_rails_forgery_protection!(controller_class)
     controller_class.class_eval do
       include Mumukit::Login::AuthenticationHelpers
       include Mumukit::Login::AuthorizationHelpers

data/lib/mumukit/login/helpers/authentication_helpers.rb

@@ -37,6 +37,6 @@ module Mumukit::Login::AuthenticationHelpers
   end
 
   def login_provider
-    Mumukit::Login.config.provider
+    Mumukit::Login.provider
   end
 end

data/lib/mumukit/login/provider.rb

@@ -1,8 +1,23 @@
 module Mumukit::Login::Provider
+  PROVIDERS = %w(
+    developer
+    saml
+    auth0
+    google
+  )
+
   def self.from_env
     parse_login_provider(login_provider_string)
   end
 
+  def self.enabled_providers
+    if ENV['MUMUKI_ENABLED_LOGIN_PROVIDERS'].blank?
+      PROVIDERS
+    else
+      ENV['MUMUKI_ENABLED_LOGIN_PROVIDERS'].split ', '
+    end
+  end
+
   def self.login_provider_string
     if ENV['MUMUKI_LOGIN_PROVIDER'].blank? || ENV['RACK_ENV'] == 'test' || ENV['RAILS_ENV'] == 'test'
       'developer'
@@ -19,13 +34,26 @@ module Mumukit::Login::Provider
         Mumukit::Login::Provider::Saml.new
       when 'auth0'
         Mumukit::Login::Provider::Auth0.new
+      when 'google'
+        Mumukit::Login::Provider::Google.new
       else
         raise "Unknown login_provider `#{login_provider}`"
     end
   end
+
+  def self.setup_providers!(omniauth)
+    enabled_providers.each { |it| parse_login_provider(it).configure_omniauth!(omniauth) }
+  end
+end
+
+module Mumukit::Platform::Organization::Helpers
+  def login_provider_object
+    @login_provider_object ||= login_provider.try { |it| Mumukit::Login::Provider.parse_login_provider it } # add provider settings in the future
+  end
 end
 
 require_relative './provider/base'
-require_relative './provider/saml'
-require_relative './provider/auth0'
-require_relative './provider/developer'
+
+Mumukit::Login::Provider.enabled_providers.each do |it|
+  require_relative "./provider/#{it}"
+end

data/lib/mumukit/login/provider/auth0.rb

@@ -15,8 +15,7 @@ class Mumukit::Login::Provider::Auth0 < Mumukit::Login::Provider::Base
 
   def header_html(*)
     <<HTML
- <script src="https://cdn.auth0.com/js/lock/11.5.2/lock.min.js"></script>		
- </script>
+ <script src="https://cdn.auth0.com/js/lock/11.5.2/lock.min.js"></script>
 HTML
   end
 

data/lib/mumukit/login/provider/base.rb

@@ -9,12 +9,15 @@ class Mumukit::Login::Provider::Base
     controller.redirect! auth_path
   end
 
-  def configure_rails_forgery_protection!(action_controller)
-    action_controller.protect_from_forgery with: :exception
+  def login_path(controller)
+    create_uri '/login', login_path_params(controller)
   end
 
-  def login_path(controller)
-    create_uri '/login', origin: create_uri(controller.request.path, controller.request.params)
+  def login_path_params(controller)
+    {
+        origin: create_uri(controller.request.path, controller.request.params),
+        organization: Mumukit::Platform::Organization.current.name
+    }
   end
 
   def auth_path

data/lib/mumukit/login/provider/developer.rb

@@ -2,7 +2,4 @@ class Mumukit::Login::Provider::Developer < Mumukit::Login::Provider::Base
   def configure_omniauth!(omniauth)
     omniauth.provider :developer
   end
-
-  def configure_rails_forgery_protection!(*)
-  end
 end

data/lib/mumukit/login/provider/google.rb

@@ -0,0 +1,17 @@
+class Mumukit::Login::Provider::Google < Mumukit::Login::Provider::Base
+  def configure_omniauth!(omniauth)
+    omniauth.provider :google_oauth2,
+                      google_config.client_id,
+                      google_config.client_secret
+  end
+
+  def name
+    'google_oauth2'
+  end
+
+  private
+
+  def google_config
+    Mumukit::Login.config.google
+  end
+end

data/lib/mumukit/login/provider/saml.rb

@@ -14,9 +14,6 @@ class Mumukit::Login::Provider::Saml < Mumukit::Login::Provider::Base
                       idp_sso_target_url: saml_config.idp_sso_target_url,
                       idp_slo_target_url: saml_config.idp_slo_target_url,
                       slo_default_relay_state: saml_config.base_url,
-                      idp_cert: File.read('./saml_idp.crt'),
-                      certificate: File.read('./saml.crt'),
-                      private_key: File.read('./saml.key'),
                       attribute_service_name: 'Mumuki',
                       request_attributes: [
                           {name: 'email', name_format: 'urn:oasis:names:tc:SAML:2.0:attrname-format:basic', friendly_name: 'Email address'},
@@ -27,14 +24,15 @@ class Mumukit::Login::Provider::Saml < Mumukit::Login::Provider::Base
                           name: [saml_config.translation_name],
                           email: [saml_config.translation_email],
                           image: [saml_config.translation_image]
+                      },
+                      setup: lambda { |env|
+                        options = env['omniauth.strategy'].options
+                        options[:idp_cert] = File.read('./saml_idp.crt')  # This is just a quickfix to avoid breaking if there are no saml configuration files.
+                        options[:certificate] = File.read('./saml.crt')   # It could also serve to parametrize these files by organization
+                        options[:private_key] = File.read('./saml.key')   # and have multiple organizations with different saml providers though.
                       }
   end
 
-  def configure_rails_forgery_protection!(_controller_class)
-    # FIXME this is big security issue
-    # Do nothing (do not protect): the IdP calls the assertion_url via POST and without the CSRF token
-  end
-
   def logout_redirection_path
     "#{auth_path}/spslo"
   end

data/lib/mumukit/login/settings.rb

@@ -7,7 +7,7 @@ class Mumukit::Login::Settings
       user_pass: 'Username-Password-Authentication'
   }
 
-  attr_accessor :login_methods
+  attr_reader :login_methods
 
   def initialize(login_methods = Mumukit::Login::Settings.default_methods)
     @login_methods = login_methods.map(&:to_sym)

data/lib/mumukit/login/version.rb

@@ -1,5 +1,5 @@
 module Mumukit
   module Login
-    VERSION = '5.3.2'
+    VERSION = '6.0.0'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: mumukit-login
 version: !ruby/object:Gem::Version
-  version: 5.3.2
+  version: 6.0.0
 platform: ruby
 authors:
 - Franco Leonardo Bulgarelli
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-08-01 00:00:00.000000000 Z
+date: 2018-09-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -150,6 +150,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.6'
+- !ruby/object:Gem::Dependency
+  name: omniauth-google-oauth2
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.5'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.5'
 - !ruby/object:Gem::Dependency
   name: mumukit-core
   requirement: !ruby/object:Gem::Requirement
@@ -184,14 +198,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '2.5'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '2.5'
 description: 
 email:
 - franco@mumuki.org
@@ -219,6 +233,7 @@ files:
 - lib/mumukit/login/provider/auth0.rb
 - lib/mumukit/login/provider/base.rb
 - lib/mumukit/login/provider/developer.rb
+- lib/mumukit/login/provider/google.rb
 - lib/mumukit/login/provider/saml.rb
 - lib/mumukit/login/settings.rb
 - lib/mumukit/login/shared_session.rb